Mozilla browser "about:" exploit

[sidki3003]

I don't know which tags would be exploitable, but a common practice to create popups - including requested ones - is opening them as "about:blank" and then writing content to them via a script.

A fairly speedy way to cover all tags that can have a "src" attribute is:

Code:

[Patterns]
Name = "<*>: Cover "src" Tags"
Active = FALSE
Bounds = "<[efils]*>"
Limit = 4096
Match = "*\ssrc=$AV(*this*)*"
Replace = "that"

There is one tag that isn't covered this way - <applet src=...> - but adding "a" would slow things down considerably and "src" is used rarely there - Mozilla doesn't even accept it.

sidki